$ the-wire · showcase
Realtime patches HIGH CVE in mint, ClickHouse ETL stops dropping inserts
By RepoJournal · Filed · About Supabase · Composed from the cited sources · methodology
![realtime-release-bot[bot]](https://avatars.githubusercontent.com/u/54469796?v=4)
11 people shipped this
jmqd
@jmqd
2 cited
Eduardo Gurgel
@edgurgel
1 cited
realtime-release-bot[bot]
@realtime-release-bot[bot]
1 cited
leandrocp
@leandrocp
1 cited
farazdagi
@farazdagi
1 cited
supabase-evals-releaser
@supabase-evals-releaser
mattrossman
@mattrossman
supabase-evals-releaser[bot]
@supabase-evals-releaser[bot]
seangeo
@seangeo
jvoegele
@jvoegele
github-actions[bot]
@github-actions[bot]
Supabase shipped a security bump for the Realtime HTTP/2 client, closed two silent data-loss paths in the ClickHouse ETL, and promoted its tenant/cluster metrics split to v2.140.0.
fix: bump mint (#2299) supabase/realtime
Realtime bumped Mint past 1.10.1, which carried EEF-CVE-2026-91043 (HIGH, GHSA-9x8p-qrf4-jq7g), where HPACK-indexed cookie fields in HTTP/2 responses bypass max_header_list_size and exhaust client memory; a second fix covers CVE-2026-92103, where the client buffers oversized frames up to 16 MiB before enforcing max_frame_size. Any service still resolving mint 1.10.1 on the Realtime path is expo...
clickhouse: stop dropped and resurrected inserts supabase/etl
By default ClickHouse treats an insert whose rows match a recent one as a retry and can drop it, so two distinct copy batches containing the same rows (100 identical "/home" values in a keyless table) collapsed into one, and timed-out inserts were queued and written later. The copy batch ID is now sent as the deduplication token, so distinct batches survive while a genuine redelivery is still d...
clickhouse: resync error on column type changes supabase/etl
Before this, a Postgres column type change only logged a warning and ETL kept writing positional RowBinary rows into the old ClickHouse column, so same-width changes like bigint to double precision stored reinterpreted bits and wider ones like integer to bigint failed every insert. A changed mapped type now fails the schema change with a resync error, and column names and types travel with each...
fix(config): make environment mutation explicitly unsafe supabase/etl
Environment::set exposed process-environment mutation through a safe API without enforcing std::env::set_var's requirements, and test and benchmark tracing used it to pick logging output potentially after other threads had started. The setter is now unsafe with documented requirements, and init_tracing_for_environment selects console or file logging without touching APP_ENVIRONMENT.
fix: pg changes committed behind a synchronous standby supabase/realtime
PG Changes could drop an RLS-authorized INSERT whose COMMIT was waiting on a synchronous standby, a gap reported by @kabochya of Multigres and built on his findings. synchronous_standby_names defaults to empty in Postgres, so deployments that never set it have never hit the wait, and therefore never hit the loss.
v2.140.0 supabase/realtime
v2.140.0 carries the metrics split that sends global metrics to central VictoriaMetrics and tenant metrics to a separate endpoint, plus ongoing presence refactoring into PresenceHandler ahead of the planned optimisation work.
Action items
- → Bump mint past 1.10.1 in Realtime deployments to clear CVE-2026-91043 and CVE-2026-92103 supabase/realtime [immediate]
